[php-src] Issue #22554: Use-After-Free in DOMXPath custom-function path

Issue: https://github.com/php/php-src/issues/22554
Author: alexandre-daubois

### Description

Originally reported by @waseem-cve.

The following code:

```php
<?php
$doc = new DOMDocument; $doc->loadXML('<root/>');
$xp = new DOMXPath($doc);
$xp->registerNamespace('my','my.ns');
$xp->registerPHPFunctionNS('my.ns','include', function() {
    $d = new DOMDocument;
    $d->loadXML('<r><uaf/></r>');

    return $d->documentElement;
});

$xp->registerPHPFunctionNS('my.ns','process', function($arg) {
    return 'x';
});

$xp->query('my:process(my:include()/uaf)');
unset($xp);
```

Resulted in a UAF. The argument-node proxy is created against the DOMXPath's own `dom_object` instead of the node's document, so it holds no reference on the foreign document. When `node_list` is torn down at `unset($xp)`, that document is freed while the proxy still points into it.

Similar issue: https://github.com/php/php-src/issues/22077


### PHP Version

```plain
-
```

### Operating System

_No response_